CVE-2026-61397 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAut

CVE-2026-59799 - Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin

CVE-2026-59780 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP

CVE-2026-59657 - Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage

CVE-2026-59655 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAut

CVE-2026-59085 - Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable

CVE-2026-50222 - Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in A

CVE-2026-50112 - SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing t

CVE-2026-47359 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

CVE-2026-77264 - The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin fo

CVE-2026-73537 - Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited

CVE-2026-19441 - Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake

CVE-2026-16323 - Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectP

CVE-2026-75796 - The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized

CVE-2026-19435 - The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before retur

CVE-2026-19085 - The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of

CVE-2026-18781 - The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not v

CVE-2026-16962 - The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any

CVE-2026-16959 - The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before

CVE-2026-16577 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d

CVE-2026-16576 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d

CVE-2026-16575 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d

CVE-2026-14601 - The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a paramete

CVE-2026-14325 - The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not e

CVE-2026-13736 - The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-onl

CVE-2025-15671 - The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on

CVE-2026-65645 - Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15,

CVE-2026-65644 - Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 h

CVE-2026-45202 - Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU mem

CVE-2026-45201 - Software installed and run as a non-privileged user may conduct improper GPU system calls to pass in

CVE-2026-45199 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-18409 - The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Te

CVE-2026-76158 - External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center f

CVE-2026-76137 - Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running

CVE-2026-76131 - Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate

CVE-2026-73267 - A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant wi

CVE-2026-77392 - A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and

CVE-2026-77391 - A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS,

CVE-2026-76157 - Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management

CVE-2026-76156 - OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.

CVE-2026-76155 - Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a rem

CVE-2026-77651 - The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project

CVE-2026-77650 - The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a pr

CVE-2026-77649 - The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project

CVE-2026-43679 - This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An

CVE-2026-20679 - The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Son

CVE-2026-16520 - Improper input validation and Exposure of sensitive information through data queries vulnerability i

CVE-2026-77648 - In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_f

CVE-2026-77647 - SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited i

CVE-2026-77113 - Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allow

CVE-2026-77646 - A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PT

CVE-2026-77645 - A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC Flex

CVE-2026-77644 - A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliabili

CVE-2026-77643 - A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core

CVE-2026-77642 - tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signatu

CVE-2026-72860 - The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues se

CVE-2026-72858 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-72848 - SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documente

CVE-2026-72846 - Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendW

CVE-2026-72843 - The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/m

CVE-2026-72818 - The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and app

CVE-2026-70105 - Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose infor

CVE-2026-69855 - Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to di

CVE-2026-69851 - Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevat

CVE-2026-69836 - Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c

CVE-2026-69558 - Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized

CVE-2026-69555 - Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a ne

CVE-2026-69543 - Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevat

CVE-2026-69519 - Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose infor

CVE-2026-69419 - Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to exe

CVE-2026-69400 - Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a

CVE-2026-68789 - Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da

CVE-2026-68782 - Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da

CVE-2026-67448 - Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/

CVE-2026-67447 - Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's interna

CVE-2026-66800 - Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose

CVE-2026-66309 - Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov

CVE-2026-65816 - Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevat

CVE-2026-65801 - Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to e

CVE-2026-65770 - Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed

CVE-2026-64773 - An attacker that can reach a container's published TCP port may be able to force the host's forwardi

CVE-2026-63509 - Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over

CVE-2026-62945 - TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions a

CVE-2026-62834 - Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attack

CVE-2026-55894 - Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.

CVE-2026-55893 - Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.

CVE-2026-55769 - CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.

CVE-2026-55765 - CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.

CVE-2026-55491 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape m

CVE-2026-55489 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could s

CVE-2026-55015 - Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny servic

CVE-2026-55013 - Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to per

CVE-2026-54509 - TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link

CVE-2026-54508 - TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before n

CVE-2026-54505 - TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK int

CVE-2026-54389 - Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser t

CVE-2026-50192 - Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the

CVE-2026-49436 - LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API

CVE-2026-49245 - SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline qu

CVE-2026-49244 - SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public we

CVE-2026-49217 - Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorizati

CVE-2026-46682 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authentica

CVE-2026-46355 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebu

CVE-2026-19783 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory co

CVE-2026-19449 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unpriv

CVE-2026-19448 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the

CVE-2026-19446 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a cr

CVE-2026-19442 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtua

CVE-2026-19437 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-18842 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-18840 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-18835 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute

CVE-2026-18832 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-18828 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-18824 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute

CVE-2026-18822 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv

CVE-2026-18716 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain

CVE-2026-18670 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17436 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17425 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17424 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restr

CVE-2026-17423 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info

CVE-2026-17422 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-17195 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv

CVE-2026-17171 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary fi

CVE-2026-17170 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17168 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute

CVE-2026-17165 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17163 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17160 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17159 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17157 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17152 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17145 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17142 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary com

CVE-2026-17141 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17138 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17136 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17124 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-17122 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17121 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17120 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-17118 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17060 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info

CVE-2026-17040 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17024 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17009 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv

CVE-2026-17007 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive infor

CVE-2026-17006 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17003 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confid

CVE-2026-17000 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-16997 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary comm

CVE-2026-16996 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-16991 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-16989 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-16980 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv

CVE-2026-16973 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive ker

CVE-2026-16972 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info

CVE-2026-16964 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages an

CVE-2026-16958 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser

CVE-2026-16952 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv

CVE-2026-16951 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute

CVE-2026-16946 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-16945 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-16944 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-16943 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-16937 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-16936 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code

CVE-2026-16935 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-16934 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2025-52182 - The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure

CVE-2026-77641 - tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. Th

CVE-2026-77640 - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream wi

CVE-2026-77639 - Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many g

CVE-2026-77638 - Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous

CVE-2026-77587 - Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object whe

CVE-2026-77584 - Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has a

CVE-2026-77506 - Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

CVE-2026-76023 - Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed

CVE-2026-76022 - Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to exe

CVE-2026-76021 - Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute

CVE-2026-76020 - Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute a

CVE-2026-76019 - Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacke

CVE-2026-76018 - Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker lev

CVE-2026-76017 - Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to e

CVE-2026-75484 - Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in mtrudel bandit allows

CVE-2026-74836 - Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows an unaut

CVE-2026-73137 - A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Mana

CVE-2026-73040 - Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in va

CVE-2026-71485 - Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies

CVE-2026-70654 - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applicati

CVE-2026-70653 - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-s

CVE-2026-70652 - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips b

CVE-2026-70651 - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips b

CVE-2026-69242 - libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted

CVE-2026-68921 - DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpola

CVE-2026-67567 - A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a ten

CVE-2026-67446 - Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-s

CVE-2026-67445 - Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP command

CVE-2026-53804 - OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encry

CVE-2026-52021 - An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitiv

CVE-2026-43798 - A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write

CVE-2026-19755 - NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing a

CVE-2026-18420 - Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards a

CVE-2026-77151 - A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the func

CVE-2026-75910 - Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Fede

CVE-2026-72861 - The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inv

CVE-2026-63723 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9033 - An unauthenticated attacker with network access to the captive portal service of an affected device

CVE-2026-8717 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-77148 - A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the fi

CVE-2026-75526 - django CMS is an easy-to-use and developer-friendly enterprise content management system powered by

CVE-2026-75514 - BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklis

CVE-2026-72854 - msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_

CVE-2026-72852 - hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configur

CVE-2026-6822 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-6260 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-66788 - A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vu

CVE-2026-66787 - A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes.

CVE-2026-66785 - A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect ne

CVE-2026-66002 - Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-

CVE-2026-66001 - Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and aut

CVE-2026-64777 - A malicious builder peer may be able to request an in-context file by name from the host and receive

CVE-2026-63654 - Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted fr

CVE-2026-63003 - django CMS is an easy-to-use and developer-friendly enterprise content management system powered by

CVE-2026-62315 - Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_

CVE-2026-61663 - django CMS is an easy-to-use and developer-friendly enterprise content management system powered by

CVE-2026-54624 - django CMS is an easy-to-use and developer-friendly enterprise content management system powered by

CVE-2026-54622 - django CMS is an easy-to-use and developer-friendly enterprise content management system powered by

CVE-2026-53993 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53587 - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a

CVE-2026-53586 - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a

CVE-2026-53585 - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a

CVE-2026-53584 - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a

CVE-2026-53583 - libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a

CVE-2026-53569 - Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted to

CVE-2026-50190 - Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in

CVE-2026-49996 - SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle s

CVE-2026-46537 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-46536 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-46535 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-46534 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-46533 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-43678 - An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingb

CVE-2026-19683 - A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During com

CVE-2026-19586 - A pre-authentication OS command injection vulnerability has been identified in Omada gateways config

CVE-2026-15743 - Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

CVE-2026-77036 - A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailCon

CVE-2026-77031 - A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreat

CVE-2026-76641 - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger me